Chapter 5. Exposing the registry

Set defaultRoute to true by running the following command:

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

Get the default registry route by running the following command:

$ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

Get the certificate of the Ingress Operator by running the following command:

$ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

Move the extracted certificate to the system’s trusted CA directory by running the following command:

$ sudo mv tls.crt /etc/pki/ca-trust/source/anchors/

Enable the cluster’s default certificate to trust the route by running the following command:

$ sudo update-ca-trust enable

Log in with podman using the default route by running the following command:

$ sudo podman login -u kubeadmin -p $(oc whoami -t) $HOST

Set DefaultRoute to True:

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

Log in with podman:

$ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

$ podman login -u kubeadmin -p $(oc whoami -t) --tls-verify=false $HOST 1

Create a secret with your route’s TLS keys:

$ oc create secret tls public-route-tls \
    -n openshift-image-registry \
    --cert=</path/to/tls.crt> \
    --key=</path/to/tls.key>

This step is optional. If you do not create a secret, the route uses the default TLS configuration from the Ingress Operator.

On the Registry Operator:

$ oc edit configs.imageregistry.operator.openshift.io/cluster

spec:
  routes:
    - name: public-routes
      hostname: myregistry.mycorp.organization
      secretName: public-route-tls
...